# Bring Your Own Key (/docs/bring-your-own-key)

Add an API key you hold with a provider under [Settings → Your provider keys](https://www.ohmygpt.com/settings?section=provider-keys). Requests that provider serves then go out with your key: the provider bills your account for the tokens, and we charge only a service fee. The section is rolling out account by account; if you don't see it, it isn't available for your account yet.

You keep calling the API with your OhMyGPT API key as before. Nothing in the request changes.

## Which key a request uses [#which-key-a-request-uses]

| Your keys for the provider | What the request uses |
|---|---|
| A default key the provider hasn't rejected | Your default key; you pay the service fee |
| No keys, or the provider rejected your default key | Our keys, billed at the prices on [Models](https://www.ohmygpt.com/models) |

Requests sent with your keys appear under **Your own provider keys** on the [Usage](https://www.ohmygpt.com/usage) page, with the service fee charged for each.

## When the provider refuses your key [#when-the-provider-refuses-your-key]

Errors caused by your key reach you as the provider reported them, because only you can fix them:

| The provider says | You get |
|---|---|
| The key is invalid, out of credit or can't use the model | The provider's status (`401`, `402` or `403`); check the key in the provider's console |
| The key is over its rate limit | `429 rate_limit_exceeded`; the limit belongs to your account with the provider |

## Managing keys [#managing-keys]

- Each provider takes up to 5 keys. Give them names to tell them apart. Your first key for a provider becomes its default; **Make default** switches to another one.
- After you add or replace a key, we check it with the provider. A key the provider rejects shows **Rejected by provider** and is not used; replace it, or make a working key the default.
- **Replace** swaps in a new key and stops using the old one at once. **Remove** deletes a key; if it was the default, your oldest working key for that provider takes over.
- Keys are stored encrypted. The list shows only a masked hint, and nobody, including support, can read a key back.
- Only you, signed in to the console, can add or change keys. API keys can't, so a tool you hand an API key to can't swap out the provider keys on your account.